RU2700236C2 - Elevator installation with safety control system with "master-slave" hierarchy - Google Patents

Abstract

FIELD: lifting devices.

SUBSTANCE: elevator installation (1) is proposed, which comprises drive (3), cabin (5), safety functional components (9a-p) for creation of safety functions in various positions inside elevator unit (1), safety control system (11) for monitoring of all functional safety components (9a-p). Safety control system (11) has several safety control units (13) having data or signal input interface (21), some of safety control system (11) monitoring units (13) are connected to each other by communication channels (15). Safety control system (11) safety control units (13) are organized in the form of "master-slave" hierarchy, besides, security control unit (13e) is made in the form of master unit, and at least one safety control unit (13a-d) is in form of a slave unit. Slave unit (13a-d) has unit (20) for processing data or signals into control signals and interface (22) for outputting control signals to the corresponding safety control unit (13), an activated safety functional component (9a-p), which is configured to actively influence the current operational state inside elevator installation (1).

EFFECT: higher safety is achieved.

13 cl, 1 dwg

Description

The invention relates to an elevator installation, in particular an elevator installation with a security control system.

Elevator installations serve, in general, for transporting passengers or objects in the vertical direction. In order to avoid threats to passengers or objects, safety control systems are usually used. Using detecting functional safety components, i.e., for example, using data or signals from sensors or control devices, such systems monitor the current operating conditions of the elevator installation. For example, the speed of the elevator car or the closed state of the elevator door is monitored. When a critical operational condition is detected, the safety monitoring system activates suitable activated functional safety components, such as a braking device or a catcher, respectively, for braking and stopping the cab. At the same time, maximum safety requirements are imposed on safety control systems with regard to their reliability and safety.

In traditional safety monitoring systems, a central safety monitoring unit was often used, which was connected to a variety of detecting or activated safety functional components and was located in different positions inside the elevator installation. In this regard, a detecting functional safety component can be understood, for example, as a sensor or an output interface of a control device that detects and provides signals or data indicating information about the current operational status inside the elevator installation. By an activated functional safety component it is possible to understand, for example, an actuator, an engine or the like, which can actively influence the current operational state inside the elevator installation. In this case, signals or data, for example from sensors, are transmitted to the central safety control unit and processed in it. If, using the processing results, it was found that, for example, the safety-critical operating state prevails in the elevator installation, the central safety control unit appropriately controlled one or more activated safety functional components to ensure the safety of the elevator installation and, in particular, the passengers being transported. For example, when excessive cab speed is detected, a braking device or catcher is activated. At the same time, signals or data generated by the sensors were transferred to the central safety control unit unprocessed, processed exclusively in it, and then control signals were generated based on the processing results, which were sent to the activated functional safety components in order to activate them appropriately.

However, such a centrally controlled and controlled system requires, as a rule, high cabling costs. In addition, significant signal transit times may occur between locally provided detection and activated safety functional components and the centrally provided safety control unit, which can significantly increase the reaction time required by the security control system to respond appropriately to an emergency. In addition, the transmission of signals and data, for example from a plurality of distributed sensors, to a single central security monitoring unit and the central processing of data occurring therein can lead to a significant processing time and, thus, further increase the reaction time.

Therefore, in EP 2022742 A1, an elevator installation with a decentralized control system is proposed. A decentralized control system comprises several processing units, wherein signals can be transmitted via bus connections between the processing units. Compared to centralized systems, it is thus possible to reduce cabling costs and shorten the reaction time.

US 2011302466 A1 describes an elevator installation with a security monitoring system for monitoring functional safety components. The security control system contains one master unit and many slave units. The slave units are equipped with sensors and switches and receive the signals that they transmit to the master unit in a specially protected way. The master unit processes this data and, if necessary, activates the appropriate functional safety components, for example to stop the cab.

Among other things, there may be a need for a much more advanced elevator installation with an optimized, at least partially decentralized security control system.

An elevator installation according to an independent claim may correspond to such a need. Preferred options are described in the dependent clauses.

According to one aspect of the invention, there is provided an elevator installation comprising a drive, a cabin, several functional safety components for generating safety functions in various positions within the elevator installation, and a security monitoring system for monitoring all functional safety components. The security control system contains several security control units. The cab interacts with the drive and through it moves along the path of movement. The elevator installation is characterized in that at least some, preferably each of the safety control units, contains an input interface for data or signals. At the same time, at least some of the security control units of the security control system are interconnected via data exchange channels. The security control blocks of the security control system are organized in the form of a master-slave hierarchy, with one of the security control blocks made in the form of a master block, and at least one of the security control blocks in the form of a slave block. According to the invention, at least one slave unit comprises a data or signal processing unit for control signals and a control signal output interface for at least one security functional component assigned to the respective safety control unit.

Ideas regarding embodiments of the invention can be considered, inter alia, as based on the thoughts and knowledge described below, without limiting these inventions in any way.

Summarizing the above, it was found that the safety monitoring system of the elevator installation can be performed particularly reliably and efficiently if several security control units are decentralized, of which at least some can not only send signals to the central unit further, for example, sensors or other control devices, but also process these signals themselves and, on this basis, manage the functional safety components. These decentralized safety control units are thus capable of locally inputting data, for example sensors or control devices, process, and then manage the respective functional safety components. To ensure communication between the individual decentralized safety control units, they are interconnected via data exchange channels through which data or signals can be transmitted. The security control units can thereby communicate with each other. Thus, several safety control units can be combined into one common security control system, with which you can control the entire elevator installation.

Moreover, it turned out to be particularly preferable to organize several security control units in the form of a master-slave hierarchy. In this case, one of the safety control units is made in the form of a master unit, and at least one other safety control unit is in the form of a follower unit. With such a “master-slave” hierarchy, the master block is superior to the slave block or slave blocks, i.e. it has, for example, priority rights with respect to requirements, the transmission and / or further processing of signals and data, as well as with respect to the management of functional safety components.

For example, the master unit may cause the slave unit to enter a specific operating mode in which the slave unit sends signals or data from its corresponding sensors or control devices only to the master unit. The master unit can process these signals and then instruct the slave unit to manage the security functionalities assigned to it by the master unit in a manner that is defined. As an alternative, the master unit can authorize the slave unit to process such signals or data itself and, on this basis, independently manage the functional safety components.

It is also possible that the slave unit has only an input interface and transmits signals or data of its corresponding sensors or control devices only to the master unit or other slave units. Such slave units can be made simpler and, thus, cheaper.

According to one embodiment, all slave units may comprise a data or signal processing unit for control signals and an output signal interface for the control signals of at least one corresponding functional safety control unit corresponding to the security control unit. This allows maximum flexibility in the interaction of safety control units.

In other words, according to one embodiment, the at least one slave unit can input data or signals indicating the security status inside the elevator installation via the input interface, process by the data processing unit and independently control the corresponding safety functional component based on the processing result. At least this one slave unit is thereby able to actively and independently carry out part of the safety control necessary in the elevator installation. In this case, the slave unit can be connected to its corresponding detecting and / or activated functional safety components and can be located mainly in local proximity to them. Due to this local proximity, data and signal transmission times can be kept short. In particular, the data can be processed decentrally locally in the slave unit and do not require long-distance transmission to a centrally located data processing device.

The same slave unit in another operating mode, according to one embodiment, can enter data or signals indicating the security status inside the elevator installation via the input interface and transmit via the data exchange channel to the master unit. Then the master unit can, through its data processing unit, process the data or signals and transmit the processing results via the data exchange channel to the slave unit. Finally, the slave unit can control the corresponding safety functional component based on the transmitted processing results. In this case, the slave unit behaves passively and sends signals or data only of sensors or other devices further to the master unit, and the control commands of the master unit continue to the corresponding functional safety components. However, the actual data processing does not occur in the passive slave unit in this case, but in the master unit.

If necessary, one or more slave units that are designed exclusively for this passive operating mode can also be provided in the elevator installation. However, at least one of the slave units available in the elevator installation must be able to process signals or data actively, i.e. independently, and generate control signals from them, with the help of which the corresponding functional safety component can be controlled directly, i.e. without involvement of the lead block.

True, this slave unit is subordinate to the master unit and, therefore, according to one embodiment, can independently control the corresponding functional safety component only when it has been previously authorized by the master unit. In other words, the master unit can accordingly control the slave unit, so that it either enters the operating mode in which it independently controls the corresponding functional safety component, or enters the operating mode in which it does not operate independently, but, for example, only passively transfers data further.

Thus, the master unit can decide whether to control the centrally defined control functions for it itself or whether these functions should be carried out by decentralized subordinate safety control units in the form of slave units. If necessary, the master unit can also instruct the slave unit how it should perform the control function.

According to one particular variant, at least one slave unit enters data or signals indicating the security status inside the elevator installation via the input interface, and through the data processing unit it continuously monitors them and transmits data or signals to the master unit via the data exchange channel only then when a specified critical security state is detected using data or signals. The slave unit can thereby independently take on a significant share of the control costs and thereby, for example, offload the master unit. Only in the case when the slave unit, for example, detects that it is necessary to proceed from the fact that the elevator installation is not in the normal state on the basis of the signals entered by it and continuously monitored, it informs the master unit. To do this, the slave unit can send the signals or data it has input directly to the master unit or, alternatively, pre-process them and then send them a pre-processed result. It is also possible to transmit a warning signal type to the master unit. In response to this, the master unit can decide how to proceed further and, for example, instruct the slave unit to take measures, due to appropriate control of the safety functional elements, that will put the elevator unit back into normal state or, at least, into a safe state.

According to one embodiment, each slave unit can exchange signals or data with the master unit over a data exchange channel. In other words, each of the slave units is attached to the master unit so that signals or data can be transmitted between the two units. Advantageously, there is only one communication channel between each slave unit and the master unit. You can also provide one common data exchange channel from the master unit to several slave units. In this case, the release of the data exchange channel for data transmission is coordinated mainly by the leading unit.

The data exchange channel can be performed arbitrarily and can be adapted, in particular, for a specific type of data transfer or for a specific application.

For example, according to one embodiment, the security control units and the communication channels can be designed to securely transmit data over the communication channels. For example, a security protocol may be used to transmit data. In this regard, as “safe” data transmission can be considered when it corresponds, for example, to DIN ISO 61508 or meets the standard level of safety integrity 3. Secure data transmission can contribute to the reliability of the security control system. In particular, it is possible to detect system malfunctions or manipulations with data transmission.

Further, according to one embodiment, suitable bus systems for purposefully assigning data or signals to one of the slave units or from one of the slave units may be provided within the data channel. Serial or parallel bus systems may be used. For example, a CAN bus may be provided. Bus systems can provide controlled, fast and / or reliable data transfer without the need for a direct cable connection of each unit to each other unit. Instead, the bus system may provide, for example, shared data in a controlled manner to various participants.

In particular, bus systems can be provided for transferring data between the master and slave units, which provide especially fast data transfer in order to take care of the short transmission time, and thus, the possibility of a quick response within the security control system.

According to one embodiment, the communication channels can be designed to wirelessly transmit data or signals. For example, data and / or signals can be transmitted using technologies such as WLAN, RF data transmission or optical data transmission, for example by modulated laser radiation. Due to this, it is possible to significantly reduce the cost of cabling in the elevator installation. Wireless data transmission, for example between a cabin and a shaft, would allow creating, for example, an elevator installation without hanging cables.

Alternatively, signals or data can also be transmitted using cables, for example, through technologies such as Ethernet, UART (universal asynchronous transceiver), etc. It is also possible to transmit data by modulating information on the wiring, which serves, for example, for power supply inside the elevator installation.

According to one embodiment, the data processing unit of the master unit has a higher data processing speed than the data processing unit of the slave unit. In other words, the master and slave units are distinguished by their data processing capabilities. A slave unit is required, for example, only to receive data or signals from specific sensors attached to it, process it, and then control the executive bodies attached to it. However, the master unit must be able to receive data and signals from various sources, process and further send the resulting signals to the executive bodies. Therefore, the processed data volume of the master unit should be significantly larger than that of the slave unit. Additionally, the master unit should be predominantly able to manage and coordinate the rights and tasks of the slave units.

According to one embodiment, the lead unit is located on a central component, such as an engine room, shaft, cab, counterweight or pit of the shaft, and at least one driven unit on another, peripheral component of the group. Thus, the master unit can be located at a distance from the slave unit or one of the slave units. Moreover, the distance between the master and slave units can be, for example, more than 2 or 10 m up to several hundred meters, for example up to 200, 500 or even 2000 m. The master or slave unit can be located directly on or near one of these components, to, for example, control their functions. In this case, the distance between the master and slave units can be noticeably greater than the distance between the slave unit and the functional safety components attached to it, i.e. sensors and executive bodies. Thus, it is possible to keep the duration of data transmission short, in particular in operational situations in which a locally self-acting slave unit controls the functional safety components.

Embodiments of the invention provide many advantages.

For example, a decentralized safety control system for an elevator installation, which is divided into several different safety subcomponents (also called SSUs - Safety Supervision Units), can provide reliable control of distributed systems. This can provide particularly good suitability for very long elevators, the so-called high-rise elevators. In this case, it is preferable to use the fact that the master and at least one slave units are interconnected by a communication channel and can exchange information, each of these master and slave units may contain its own sensor system, which is controlled by it.

By using various control units, mainly spatially separated from each other, a larger system can be controlled, i.e., for example, a higher elevator shaft and / or locally or logically group security tasks.

Due to the decentralized, distributed location of the system, smaller sections or sensor systems can arise that can be operated at a higher data transfer or processing speed.

Further, due to the division into several subsystems with their own safety control units, it is also possible to increase the number of participants, i.e., for example, the number of functional safety components that are monitored in the elevator installation as a whole. This can increase the safety of the elevator installation.

Various topologies or implementations are possible.

For example, several independent security control units (SSUs) may be provided with a master and one or more slave units. At the same time, only the leading unit can actively intervene, i.e., for example, affect the safety circuit of the elevator installation. All slave units report their status to the master unit, which then, for example, can decide if there is a security risk at the moment and trigger a suitable response. In such a device, the master unit can combine information from various units and respond accordingly “smarter”. In general, combined benefits are realized.

Alternatively, several independent safety monitoring units may be provided. Each or some of these units may be able to intervene and respond to a security risk. Additionally, the blocks can, for example, exchange information with each other, for example, for diagnostic purposes. However, in such a device, as a rule, there are no combined advantages, for example, due to a combination of superior information.

It should be pointed out that some of the possible features and advantages of the invention are described in it with reference to various options for its implementation. One skilled in the art will recognize that features can be suitably combined, harmonized, or replaced in order to arrive at other embodiments of the invention.

Below, embodiments of the invention are described with reference to the accompanying drawing, and neither the drawing nor the description should be construed as limiting the invention.

In FIG. 1 is a functional diagram of an elevator installation according to one embodiment of the invention.

The figure is schematic and not to scale.

In FIG. 1 is a diagram of an elevator installation 1 according to one embodiment of the invention. The elevator installation 1 comprises a drive 3 and a cabin 5. A cabin 5 can be driven by a drive 3 in a shaft 7 along a travel path. The cable 21 directed along the bending blocks 23 connects the cab 5 with the counterweight 17.

The elevator installation 1 comprises a plurality of detecting and / or activated safety monitoring components 9a-9p, which are distributed throughout the elevator installation and are located in different places, for example, in shaft 7, on drive 3, or on doors of shaft 7 or cabin 5.

The safety monitoring system 11 serves to monitor the elevator installation in order to detect, for example, safety-critical conditions and, if necessary, take measures. In this case, the security control system 11 serves to control and coordinate the various components of the security control 9a-9p.

The security monitoring system 11 includes several security monitoring units 13a-13c. They are located in different places inside the elevator installation 1.

For example, the first safety monitoring unit 13a is located on the cab 5 and is connected to several safety monitoring components 9c, 9d, 9e, 9l, 9k, 9j also located there. The connection may be wired and wireless and allow for the exchange of data or signals. The components of the security control can be detecting and are made, for example, in the form of sensors, detectors, actuated contacts, etc., so that it is possible to determine operating conditions inside the elevator installation 1, i.e. in this case, on the cab 5. Safety control components can also be activated and made in the form of, for example, actuators, motors, etc., to trigger certain functions inside the elevator installation 1. For example, components 9c, 9d, 9e, 9l , 9k, 9j safety controls can be performed as a detecting component in the form of a catcher contact, emergency end contact, emergency braking switch, cabin door contact, etc. or as an activated component in the form of an activating brake device or catcher of the executive body.

The second safety control unit 13b may be located, for example, on the counterweight 17. The third safety control unit 13c may be located, for example, in the pit 19 of the shaft. The fourth safety control unit 13d may serve, for example, to control the doors of the shaft 7. Each of these safety control units 13b, 13c, 13d may be connected to one or more locally provided and corresponding functional components 9f, 9g, 9h, 9i, 9m safety, for example in the form of a contact of faulty ropes, an emergency braking switch in the pit of the shaft, a contact of faulty ropes of a speed limiter, etc.

The fifth safety control unit 13e is located, for example, in the engine room of the drive 3. This safety control unit 13e is connected to nearby functional safety components 9a, 9b, 9n, 9o, 9p, for example in the form of a catcher contact for a counterweight, a speed limiter contact , emergency brake switch in the engine room, etc.

Each or at least some of the security control units 13a-13e comprises its own data processing unit 20 (shown only for the security control unit 13a). The data processing unit may include, for example, a processor, a central processing unit or the like, as well as, if applicable, a storage medium for storing data. The security control units 13a-13e may further comprise an input interface 21 and an output interface 22 (shown only for the security control unit 13a) through which data can be input, for example, from one of the security detection functional components 9a-9p or output to one of the activated functional components 9a-9p security.

At least some of the security monitoring units 13a-13e are thus able, at least locally, to independently solve security monitoring tasks due to the fact that data or signals are input, for example, by sensors, processed in a data processing unit, and then suitable way is the management of executive bodies.

All or at least some of the security monitoring units 13a-13e are interconnected by data exchange channels 15. In this case, the communication channels 15 can be made wired or wireless. The distances at which the security control units 13a-13e are interconnected by the data exchange channels 15 are usually noticeably greater than the distances between one of the security control units 13a-13e and the corresponding functional safety components 9a-9p. Channels 15 for the exchange of data can have bus systems with which you can control the transmission or flow of data.

In this example, the fifth safety control unit 13e is designed as a master unit, and the four security control units 13a-13d are designed as slave units. All slave units are connected to the master unit directly or indirectly by communication channels 15. The master unit can, therefore, both receive data or signals from the slave units, and transmit them to it.

In this case, the master unit can also specify how data or signals should be transmitted from one of the slave units to the master unit or whether the slave unit should act independently.

For example, the master unit can ask each of the slave units whether it should only transmit data or signals to the master unit that it receives from its corresponding detecting functional safety components, or whether it should partially or fully independently process these data or signals. Mixed modes can also be used in which, for example, some data must be processed by the slave unit itself, and other data must be transferred to the master unit unprocessed. Partial pre-processing of the data received from the slave unit within the slave unit and subsequent transmission of the pre-processed data to the master unit are also possible.

The master unit can also be connected to bus systems provided in the data exchange channels 15 and may be entitled to control them, including the data flow through the data exchange channels 15.

Due to the equipment of the proposed elevator installation 1 with a decentralized security control system 11, the elevator installation 1 can provide extremely flexible and suitable work to various environmental conditions using a large number of safety control units 13a-13e distributed in it, organized in a master-slave hierarchy. In particular, control tasks can be carried out being distributed across several security control units, however, however, the master unit, in principle, can at any time maintain control over the type and degree of tasks performed by the slave units. Due to this, you can ensure high security system. At the same time, the host unit does not need to have a very high data processing speed, because it can provide slaves with a solution to some of the security control tasks. This can help, among other things, reduce costs. In addition, control tasks directly carried out by slave units can be carried out very quickly, because the distances over which data is transmitted can be kept short. In turn, this can contribute to a quick reaction and, for example, to increase the safety of the elevator installation, for example, if a critical operational state is quickly detected and response measures, such as activating the braking device or catcher, should be quickly initiated.

In conclusion, it should be pointed out that the terms “comprising”, “including”, etc. do not exclude other elements or steps, and the term “one” or “one” does not exclude many. Further, it should be pointed out that the features or steps described with reference to one of the cited exemplary embodiments may be used in combination with other features or steps of the other cited exemplary embodiments. The reference position in the claims should not be construed as limiting.

Claims (13)

1. An elevator installation (1) having a drive (3), a cabin (5), configured to interact with the drive (3) and move by means of the drive (3) along the movement path, several functional safety components (9a-p) for education security functions in various positions inside the elevator installation (1), a security monitoring system (11) for monitoring all functional safety components (9a-p), the security monitoring system (11) having several security monitoring units (13) containing an interface (21) ) data entry or si the bulk, and at least some of the security control units (13) of the security control system (11) are interconnected by data exchange channels (15), and moreover, the security control units (13) of the security control system (11) are organized in a hierarchy "Master-slave", moreover, the security control unit (13e) is made in the form of a master unit, and at least one security control unit (13a-d) is in the form of a slave unit, characterized in that at least one the slave unit (13a-d) has a unit (20) for processing data or signals in control signals and an interface (22) for outputting control signals to a safety monitoring unit (13), an activated functional safety component (9a-p), which is capable of actively influencing the current operational state inside the elevator installation (1). 2. Installation according to claim 1, characterized in that all the slave units (13a-d) contain a unit (20) for processing data or signals into control signals and an interface (22) for outputting control signals to a functional component corresponding to the safety monitoring unit (13) (9a-p) security. 3. Installation according to claim 1 or 2, characterized in that at least one slave unit (13a-d) is configured to input data or signals indicating the security status inside the elevator installation (1) through the interface (21) input, processing by the data processing unit (20) and based on the result of self-management processing of the corresponding functional safety component (9a-p). 4. Installation according to claim 3, characterized in that the slave unit (13a-d) is configured to independently control the corresponding functional safety component (9a-p) only when it has been previously authorized by the master unit (13e). 5. Installation according to any one of paragraphs. 1-4, characterized in that at least one slave unit (13a-d) is configured to enter data or signals indicating the security status inside the elevator installation (1), through the input interface (21), independent continuous monitoring by unit (20) for data processing and transmission to the host unit (13e) via the data exchange channel (15) only when a specified critical operational state is detected using data or signals. 6. Installation according to any one of paragraphs. 1-5, characterized in that at least one slave unit (13a-d) is configured to enter data or signals indicating the security status inside the elevator installation (1), through the input and transmission interface (21) to the host unit (13e) via a data exchange channel (15), the master unit (13e) being configured to process the transmitted data or signals through its data processing unit and transmit the processing results to the slave unit (13a-d) via the data exchange channel (15), moreover, the slave unit (13A-d) is configured to data management processing results corresponding functional safety component. 7. Installation according to any one of paragraphs. 1-6, characterized in that each slave unit (13a-d) is configured to exchange data or signals with the master unit (13e) via a data exchange channel (15). 8. Installation according to any one of paragraphs. 1-7, characterized in that the blocks (13a-e) of the security control are made for the safe transmission of data through the channels (15) of data exchange. 9. Installation according to any one of paragraphs. 1-8, characterized in that the communication channels (15) are made for the wireless transmission of data or signals. 10. Installation according to any one of paragraphs. 1-9, characterized in that inside the data exchange channel (15), bus systems are provided for purposefully correlating data or signals to one or from one of the slave units (13a-d). 11. Installation according to any one of paragraphs. 1-10, characterized in that the data processing unit of the master unit (13e) has a higher data processing speed than the data processing unit (20) of the slave unit (13a-d). 12. Installation according to any one of paragraphs. 1-11, characterized in that the drive unit (13e) is located on a central component selected from the group consisting of a drive (3), an engine room, a shaft (7), a cabin (5), a counterweight (17) and a pit (19 ) mine, and at least one slave unit (13a-d) on another, peripheral component of the named group. 13. Installation according to any one of paragraphs. 1-12, characterized in that it contains at least two security control units, each made in the form of a slave unit (13a-d).

Images